4dbb07a1cfd3c0cfad87affccb15c63dbf969bbd60d2c4a20be67b684da4d389

Analysis

max time kernel
149s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_6f287ffad6c31b3f412bceb9d2b6d447_icedid_njrat_vidar.exe
Size 6.4MB
Sample260602-b5rcqact6k
SHA256 4dbb07a1cfd3c0cfad87affccb15c63dbf969bbd60d2c4a20be67b684da4d389
MD5 6f287ffad6c31b3f412bceb9d2b6d447
SHA1 576492a3912f2654a83bf4f1d66db2db9fe36891
SHA512 bf712b53594d19c61e5ec0fc3b99d65e3b9922f5a5bdaa38307f50c00243e60c4078d5f588e3c75ef6e34b9da067a9b0b00cb3cef2190c0c2ea85d69905df10c
SSDEEP 98304:gIQE9gsWBU+ExXFm3dGANRNWFlPNn5fP58/oPbz20ZnJxjv3dDPi4G:gnEKPEz0dGAYDFn5fxuoTzPZJpv3RLG
TLSH
T13E66336777E855EDE36AD0784CE44604F6A33C244B36E3FF0B5062256E361A28D3E366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion spyware trojan

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Executes dropped EXE 2 IoCs

pid	Process
3836	ExecAssist.exe
3988	Update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 8 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ExecAssist.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	ExecAssist.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	ExecAssist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	ExecAssist.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	ExecAssist.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	ExecAssist.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	ExecAssist.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ExecAssist.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3836	ExecAssist.exe
3836	ExecAssist.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2808	1952	2026-06-02_6f287ffad6c31b3f412bceb9d2b6d447_icedid_njrat_vidar.exe	81
PID 2808 wrote to memory of 4028	2808	cmd.exe	83
PID 1952 wrote to memory of 3836	1952	2026-06-02_6f287ffad6c31b3f412bceb9d2b6d447_icedid_njrat_vidar.exe	84
PID 3836 wrote to memory of 3988	3836	ExecAssist.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-06-02_6f287ffad6c31b3f412bceb9d2b6d447_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_6f287ffad6c31b3f412bceb9d2b6d447_icedid_njrat_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c expand.exe "C:\Users\Admin\AppData\Local\Temp\FjEXF0000\MyData.cab" -f:* .
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\system32\expand.exe
    expand.exe "C:\Users\Admin\AppData\Local\Temp\FjEXF0000\MyData.cab" -f:* .
    3⤵
    - Drops file in Windows directory
    PID:4028
- C:\Users\Admin\AppData\Local\Temp\FjEXF0000\ExecAssist.exe
  "C:\Users\Admin\AppData\Local\Temp\FjEXF0000\ExecAssist.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\Update.exe
    "C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\Update.exe"
    3⤵
    - Executes dropped EXE
    PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ExecAssist.exe

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\ExecAssist.exe
Size 170KB
SHA256 3267cfb4e507c55f63065990589d517a1957aba3ebda6cfd1976eb46ff115557
MD5 30250091459e1dbca56ac462d0ca5f3a
SHA1 b2e73db00fa2a408d887b6c71d28695019f09a5e
SHA512 ff3d6ac966bef3812153ed3f27c43c97cfe596d24f361c9893696b9061bcc0a64c25fcc6c61ed9808ec49980185343443ad79a01ebffee8303be0db9020ce10a
SSDEEP 3072:O5kf7/d5blsY2GbNWzVm+jbxGHiF613oY46Sz5Be0chhhhhhKnLTgi:OCpsY2GhWnjbUHhohdz5mhhhhhhKLTv
TLSH
T10F044B0BB3A631FDE177813488925906F776B83617708ABF03A446375F27AD09D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\Update.exe
Size 263KB
SHA256 7f2ee214bcfd2578320844b14fd1780db5fe586d82fa22cbf19df7769a3d2eae
MD5 ab15398de5fafacc52794a5fdb41d5f2
SHA1 ad79b0f7ad1fe02e7f823eee38a3b7a3c3f58d31
SHA512 457c84ca04219dca9a33e0d29c0203772089c0087c519813ba3e535b881dbc9d09c392c8a86644bf9b9dfbbc2131be7827a754b1a1e274cdaae702cdd68db9f1
SSDEEP 3072:hrTMmvtwn2kej+GjGi0OyVhfPWEb4L0ovgvJfnFugUiGoY46heoB5nVdEfatqYL2:xMn2kmjjcffPzb4mJfqohHEXzRzCr
TLSH
T17B446B0673990DF8F873D13D89968905E673B8450771CAFF13A082669F67791AE3AF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChkSSD.exe

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\config\ChkSSD.exe
Size 219KB
SHA256 10f6f188c515a415d1d428c8563be01abdd1d1e7412840841a4071e6d911d42a
MD5 3336c60e925bda9e4e3d8030969745a8
SHA1 98a2c625e3f763867327e42accc9be163b2d28d6
SHA512 1fed98c75f07d9d191385625825ee55230c7f97e967f7709d255c370c10d67d11ec9de95fb5c005bce3f29b247b610e3e0269aca194f0cca4069cfa7a2d31710
SSDEEP 3072:uvECwX3/a+bnp7LGT3dU6Ucr80UtQI4A9gKicET9qkUzc8QV:l3/a4lLE3O88Krr5lUzc8QV
TLSH
T1A4247D15B7A550FAE2AB8534C9814D05FB727C460BB0AACF13904AB6DE376D0AF3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7L2QGXD7_Noformat.bin

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\config\Data\7L2QGXD7_Noformat.bin
Size 2.0MB
SHA256 932bee37dc2ede516e9a7cc136a5591deb086c069d102ce7932e94ddf8803341
MD5 eb7acf64ba05b005e871199a9956501c
SHA1 f091401901d22bf238a217e30d3a6dd3da44cf88
SHA512 78214fad34a82ed6a8e6fccdd4ed6c434d88c0da20e1eba5ecb214fd715d7afafcbf1eb951fbc2b5071357456f2e7a3a170c7070214779ba472ece813a43464a
SSDEEP 49152:u2h7vPk5lJjRZyot7kLN/cGFD7pJ/s8BgRGak:vhjPk5jF0olSiUDLUP/k
TLSH
T1D5A5F115D014F052C3F0A7BF99C6E8DE07D4F58299FEA4374272463018F891BA6BE99B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RaidFWUpdate_V1_2_3.exe

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\config\Data\RaidFWUpdate_V1_2_3.exe
Size 13.7MB
SHA256 709cec9a4633003765eead70e1af62c53bab4ab8dfe9e614dcc697db4ed73f11
MD5 09ea10e476b28ac133044d320b2dab55
SHA1 2754ef327e6150982f239be60e4869df80fd2cb8
SHA512 d49b90f7a5dfd5e98c8ab54a06b4d12224b202218564eb14fd22c97fe8221914648820fffa591686a5477aee8dac4a31859afd2154f9478782f448599376ab65
SSDEEP 98304:8Id196SNjlVt5+oxJD7nMnFLOAkGkzdnEVomFHKnPh:8TKjpRzMnFLOyomFHKnPh
TLSH
T18BE6E856E7B650D1D07AC03A9A52A27BFC713C89C77853C782415B6BAF327E0AE79700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExecPr.exe

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\config\ExecPr.exe
Size 144KB
SHA256 78811c8d98cda9d31b22c21a2de400e683aa7e195195feb60bc4c7baa010b777
MD5 f37c1b741c64954d66ed2ae616d90978
SHA1 a12e8cf05dcd3fe39a8464a0834fbbff8084e978
SHA512 1d0fe1eeba060e4fd1847913c497e579f9c17328d7e8b48668d04948c3aabc7b5cef75b8e0fbc082ea6098695354ca7612e207311bc43737e9332bbfa73b1793
SSDEEP 3072:59zqZR/kd2JYhivNdE0J/yqfcv9DMSf+vLEnVhqYlh827s:HzqZR/k5gFqi/yCcvNffTNh827s
TLSH
T1DEE36B5B72A470F8E5678639C4914A1AE7B278760731CB9F0364425A1F277D0AF3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IsAcDc.exe

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\config\IsAcDc.exe
Size 194KB
SHA256 c2e5e912c77a953f36c916eeb5b616982b7d140d3439dad44655a528a401bd59
MD5 3fc36e686625dd92e20c3a56d56d5f7e
SHA1 b793b455b6cce17478ad256dd2496768853f8b18
SHA512 c74fe7d7bd5435b3e9a032ecd5ace2cd4bb5bbb9a33b1db7d262ed3fa77b2e19077710456884c431070e89fa3e6f3b290e0aee58a2d39df7e2fdeb0e5c06a0b4
SSDEEP 3072:isDK/y+yVPjUzAXyq69kn6CcRNHfGGoY46meS5RYcdbyz8ZL1:iswyBYzAM9jCcRboh407ozM1
TLSH
T1E7146B0BB39520F9E177863488425915F772B83507719EBF07A4827A9F27790AE3BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IsRegKey.exe

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\config\IsRegKey.exe
Size 143KB
SHA256 3b6f8b01b959e84179031a2f37997e6f4920c60fe241067e62d3fce2753391da
MD5 8e11e74bb91abefc351326bdb6c61156
SHA1 a2260198a8e6c454db66f5e9b89dd6635dbf83e0
SHA512 3359e100417a655caf70ce311b88c1c113fc18f25d8afc9bae34a77862ff6fe221b35d51f23a81adb1097e18c2ce42d4e26ca41e7f95ca631da6b356a3e52153
SSDEEP 3072:XwWAjVIfDWCG3T5S1LS2ODrSv2j2KUJvRJhhZzxLN:AW2+CD3TI1+lrFxgRJHZz1N
TLSH
T147E36C4B73A870F8E176C639C991591AFBB3783506309B5F0764825A1F27391AD3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutCsv.exe

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\config\OutCsv.exe
Size 187KB
SHA256 8490a76794929f8e40349a162b1cf6e14e46486b603f5f383e38018b5b8e9ad3
MD5 8d379035ba68b5ad2471eabe3de806f1
SHA1 b403f557c5aa2021060f6af7f66fc28303be0586
SHA512 d6aaadbb76a36e6954e96ff69287ffd13195843770e2ceb2a480e354ba2afc597125694de619952325f1ca7308bc19be2cf431c6acec328fef61a50227b2e5c2
SSDEEP 3072:YJCpQdVSG7gcXDBZwx9rKrH65KUYXwe+GtSv07u4RLYh6WMWtTqheoM3MmPrkdxw:YJCpQvScgczXwx98a5VYAO7Fi6WMWtTR
TLSH
T123145B1A73A410F9E1B7813989525A56F77374260B309BDF0360837A6F23BD1AD3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Progress.exe

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\config\Progress.exe
Size 202KB
SHA256 555555c9945cdb33cf60a9b85c92a42c398d132fe8cd4cee67fd2d270b4284fa
MD5 3009815cbfcdc5fbe5436cb11847c4aa
SHA1 2cfd16dae7e65801f5d3850d00f02d240cdbc17c
SHA512 29b2114223ebc3fbd5ebfefb78ce984599216c0f54595e9ac2335f56ff2209b2b164ce78e6a30b3a68282cb7250a3a4313f91915e7f8d7e6a7152ace6692d7c7
SSDEEP 3072:nK/aejAkPSktx4mBTDBS+wXttzGdOnoY46ASeK16mYtJuoLCzVNLM:nK/aTo9tCuTmtxbohH5pJuoLCzXM
TLSH
T13D146A57729920F9E1768534C9524A46F777B83607309ABF03A4823A9F277D0AD3BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegVolKey.exe

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\config\RegVolKey.exe
Size 187KB
SHA256 dffa22afba62287ce1047409cf806af152fe7f9f0b0b07abd386a8af264ed25c
MD5 1f73e0cbe65e6b3220ec263b43f82159
SHA1 99d6c5d5f938554a9553a7a91f325413a5255829
SHA512 49caa5ae7b2787554368a324366ff3bf0182b789cc6e374d45e308daf8b6b61de9d19d8aa89457f58e65ff5c9091c8d468947ae07fec939a8215693949b26b91
SSDEEP 3072:oRBVPSRqUW4SbhgrFvjVyg2abxyu3QHFVzWH80VV:SqRqUwYFQugnzC80VV
TLSH
T1E1147D16F6A560FBD177C534C9924902FB727C660BA0AADF13600AF69F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\config\en-US\config.ini
Size 17KB
SHA256 d792fc6a86522159eb089c2e87c0f5d081d5a45bfd5e8b1b375bd997596cdf97
MD5 f16472d18e918d01d93a44c9f1ef3854
SHA1 61f53b5a211ad3266bc86536a1edfc24470626fc
SHA512 e5d7526fc10cc2b3800b72da351cff938ab1ddb0eb29eee723d0393166879e116ee4ffe23ec4835d56756d61f586e17511dfecb25ef5e5540dede92f108a9731
SSDEEP 96:B4pXayyaNeQ+a/Z5Zh1ha/Z6Z8ANMo4ca/ZbZvAyqROnXUz5a/Z9ZDA6Gq4cs10g:wP/Uyi3DXU1vHH277c0kUBi7
TLSH
T18E82C1272BE81005BAF3799ADFF984739726B8A6993DC18D80E4174F45E1D4098237FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\config\ja-JP\config.ini
Size 16KB
SHA256 bf1853f3268dbca95f399833000223bdf9d910d1f6ffc07af0ffc28b7a6a6ca5
MD5 09325927bce0e091cb1fce9ddb3a72e5
SHA1 7a28d78b1fcb523fd3c961884a46d9aba40d7b69
SHA512 8be5094effd72ca9c5ec2a29e88a79afad3046575138f0145fefc20cf9d7a46be0ec44177e1bdbae536dfe8f18a9b8e1e7cdae161e9f2f15539f36af735b2171
SSDEEP 96:BdOkJeQ+a/Z5ZhIha/Z6Z8Ahca/ZbZvABmnXUz5a/Z9ZDAg4LjHJwaBt2a/Z+Zdy:SkQnJcmXUK4pO77P0kUl9Wi7
TLSH
T1F772F4172BE81015BAB3A9AFDFF98477A326F4A5896EC48D80E4174F45E1C4098137FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

make.cmd

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\config\make.cmd
Size 195B
SHA256 e29f8066fcef601ba7676e868d762bc5a954c2bd249008c504f1b593398adc65
MD5 cf50412ac6c995cfa399c4f0733fe520
SHA1 c3fd028de3bf801a9f3d0db67d299090a78216e6
SHA512 6edc5e2d6a6b22571ccf19372cdca66b1740d23a06e184d73563b176f723eb41bd53ec463d66456ca8ed3de2625a208ccfc870c86b9db31d58e9d94a61e1117e
TLSH
T1AED02240100222D028D699A46608000CC21CA01B13680B0C60F8C8F5EB88EB36D4E7C4
MD5 SHA1 SHA512 TLSH

Submit Download

target.ini

Path C:\Users\Admin\AppData\Local\Temp\FjEXF0000\Updater\config\target.ini
Size 642B
SHA256 cd2013c3491877fa7709d14fcadcd65e9f07e6ed40efb792a532ec61ce8ae6c9
MD5 7e2b87ec9a0aa82c8fd559576f247c0e
SHA1 852b87c0545d270a4ec18cb952421857db5e8f1d
SHA512 59705593b4e3f34ed9db01ce1897e71cebd270d29b9c732683fdee467eb5a2d1ab539f49424289836ecb8369a6bc44bb4f5b023c7081848464441ca7e54945bf
TLSH
T12EF03C3B13DA600476B3AA44C2F919B3BB3339961EADD52E04D4035D18F0E60EA527B7
MD5 SHA1 SHA512 TLSH

Submit Download

mydata.cab

Path \??\c:\users\admin\appdata\local\temp\fjexf0000\mydata.cab
Size 6.2MB
SHA256 14ccf81a01e07786f9f031201db79013be6ab192ae8279c49073da0e0515da63
MD5 a41eed2e00c68bee2425f866a3a16702
SHA1 af7611a9b8b07959206728f5bf5cad53bfd35534
SHA512 c24ca4cea014ca59f20ddaa2adf9bd0d08d1344e817b3e1e7bd0695b46c98f48ec6f99c0f6368e2a719fca777e7d7df77fb56d9312010032bf9c3769a6b2bb8d
SSDEEP 196608:8jY5YbCD0QBN3d76xzcO8bK20Ffi0qgyMl8sGXe:8jV2D0Q9OxzcOPfIRMl8ve
TLSH
T14E663322853ED24BB8FDEDB9CF6F5A2044FF1700AB86841CD99E857E8A9505F2DB4053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download